Documentation
¶
Overview ¶
Package credentials delivers credentials into sandboxes for seats whose access grants sandbox delivery (the github and browser plugins), and revokes them when the grant goes (docs/sandbox.html).
Revocation has two parts. Steadmesh stops delivering at once: a seat without the grant is refused. Credentials already delivered are invalidated where the service allows it: GitHub App installation tokens are revoked at GitHub when a sync removes the seat's grant. A personal access token and browser cookies cannot be invalidated by Steadmesh; they stay usable until rotated or logged out, which the documentation states.
Index ¶
- Variables
- func Scope(a *access.SeatAccess, connection string) (connectors.CredentialScope, error)
- type Connections
- type Registry
- func (r *Registry) Issue(ctx context.Context, org, seat string, a *access.SeatAccess, connection string) (runtimeapi.CredentialResponse, error)
- func (r *Registry) Outstanding(org, seat string) int
- func (r *Registry) Reconcile(ctx context.Context, org string, seats map[string]*access.SeatAccess) []Revoked
- func (r *Registry) RevokeSeat(ctx context.Context, org, seat string) []Revoked
- type Revoked
Constants ¶
This section is empty.
Variables ¶
var ErrForbidden = errors.New("credential not granted")
ErrForbidden means the seat's access does not grant the credential.
Functions ¶
func Scope ¶
func Scope(a *access.SeatAccess, connection string) (connectors.CredentialScope, error)
Scope is what a seat's access grants on a connection, or ErrForbidden.
Types ¶
type Connections ¶
type Connections interface {
Tracker(orgID, key string) (connectors.Tracker, error)
}
Connections resolves a connection's adapter.
type Registry ¶
type Registry struct {
Connections Connections
Log *slog.Logger
Now func() time.Time
// contains filtered or unexported fields
}
Registry issues credentials and remembers revocable ones.
func (*Registry) Issue ¶
func (r *Registry) Issue(ctx context.Context, org, seat string, a *access.SeatAccess, connection string) (runtimeapi.CredentialResponse, error)
Issue delivers a credential of connection to seat (key) of org.
func (*Registry) Outstanding ¶
Outstanding counts unexpired revocable credentials of a seat.
func (*Registry) Reconcile ¶
func (r *Registry) Reconcile(ctx context.Context, org string, seats map[string]*access.SeatAccess) []Revoked
Reconcile revokes the credentials of org's seats that no longer hold the grant they were issued under. seats maps seat key to current access; a missing seat lost everything.
Source Files